Merge branch 'master' into windows_11_sprint

yml/OSBinaries/FltMC.yml

@@ -1,20 +1,18 @@
 ---
 Name: fltMC.exe
 Description: Filter Manager Control Program used by Windows
-Author: 'John Lambert'
+Author: John Lambert
 Created: 2021-09-18
 Commands:
   - Command: fltMC.exe unload SysmonDrv
     Description: Unloads a driver used by security agents
     Usecase: Defense evasion
-    Category: ADS
+    Category: Tamper
     Privileges: Admin
     MitreID: T1562.001
     OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
 Full_Path:
   - Path: C:\Windows\System32\fltMC.exe
-Code_Sample:
-  - Code:
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/c27084dd0c432335fa4369e5002a61dfe0ab9c65/rules/windows/process_creation/win_sysmon_driver_unload.yml
   - Elastic: https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_via_filter_manager.toml

yml/OtherMSBinaries/Createdump.yml

@@ -0,0 +1,23 @@
+---
+Name: Createdump.exe
+Description: Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
+Author: Daniel Santos
+Created: 2022-08-05
+Commands:
+  - Command: createdump.exe -n -f dump.dmp [PID]
+    Description: Dump process by PID and create a minidump file. If "-f dump.dmp" is not specified, the file is created as '%TEMP%\dump.%p.dmp' where %p is the PID of the target process.
+    Usecase: Dump process memory contents using PID.
+    Category: Dump
+    Privileges: SYSTEM
+    MitreID: T1003
+    OperatingSystem: Windows 10, Windows 11
+Full_Path:
+  - Path: C:\Program Files\dotnet\shared\Microsoft.NETCore.App\*\createdump.exe
+Detection:
+  - IOC: createdump.exe process with a command line containing the lsass.exe process id
+Resources:
+  - Link: https://twitter.com/bopin2020/status/1366400799199272960
+  - Link: https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnetcore/practice-troubleshoot-linux/lab-1-3-capture-core-crash-dumps
+Acknowledgement:
+  - Person: bopin
+    Handle: '@bopin2020'

yml/OtherMSBinaries/Powerpnt.yml

@@ -28,6 +28,7 @@ Full_Path:
   - Path: C:\Program Files\Microsoft Office\Office12\Powerpnt.exe
   - Path: C:\Program Files\Microsoft Office\Office12\Powerpnt.exe
 Detection:
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/8bb3379b6807610d61d29db1d76f5af4840b8208/rules/windows/process_creation/proc_creation_win_susp_msoffice.yml
   - IOC: Suspicious Office application Internet/network traffic
 Resources:
   - Link: https://twitter.com/reegun21/status/1150032506504151040